Together we make a difference

Key principals extracted form King 111 report regarding risk

Board responsibilities 1. The board should appreciate that strategy, risk, Performance and sustainability are inseparable 2. The board should be responsible for the process of risk Management 3. The board should approve the companys chosen risk Philosophy 4. The board should adopt a risk management plan 5. The board may delegate the responsibility for risk Management to a risk committee 6. The board should approve key risk indicators and tolerance Levels 7. The board should ensure that key risks are quantified and are responded to appropriately 8. The board should report on the effectiveness of risk Management 9. The board should ensure that the companys reputational risk is protected 10. The board should determine the extent to which risks relating to sustainability are addressed and reported on 11. The board should ensure that IT is aligned with business objectives and sustainability 12. The board should be consider the risk of the unknown as part of the qualitative and quantitative risk assessment process Audit committee 1. The audit committee should be an integral component of the risk management process focusing on: 3.8.1. Financial reporting and risks; 3.8.2. Review of internal financial controls; 3.8.3. Fraud risks; and 3.8.4. Information technology (IT) risks

PO Box 21606, Helderkruin 1733 Tel/Fax: (011) 764 5150 Directors: PJ Gildenhuys, NH Gildenhuys, Reg. No.: 96/09135/07

Risk management principals 2. Risk management is inseparable from the companys strategic and business processes 3. The management should be responsible for the implementation of the risk management process 4. Risk management should be practiced by all staff in their day-to-day activities 5. Risk assessments should be performed on an ongoing Basis 6. Risk identification should be directed in the context of the companys purpose Internal audit 1. Internal audit should provide independent assurance on the risk management process 2. Internal audit should provide a written assessment of the effectiveness of the companys system of internal control, performance and risk management to the board 3. Internal audit should follow a risk-based approach to its Plan 4. Internal audit through the chief audit executive should have a direct relationship with the audit committee, corporate governance committee and risk committee